Apple Fixes Safari WebKit Flaws and Xcode Root File-Read Vulnerability

Apple released Safari 26.4 and Xcode 26.4 security updates to address multiple vulnerabilities affecting macOS systems. The Safari update for macOS Sonoma and macOS Sequoia fixes seven CVE-tracked issues in WebKit and WebKit Sandboxing that could enable Content Security Policy and Same Origin Policy bypasses, cross-site scripting, process crashes, cross-origin access to script message handlers, improper processing of restricted web content, and user fingerprinting. Apple said the flaws were mitigated through improved state management, input validation, logic checks, memory handling, and authorization controls.

The Xcode 26.4 advisory covers two vulnerabilities on systems running macOS Tahoe 26.2 and later. Apple patched an out-of-bounds read in otool (CVE-2026-28890) that could let an app trigger an unexpected system termination, and a permissions flaw in Simulator (CVE-2026-28889) that could allow an app to read arbitrary files as root. Apple credited external researchers for the findings and made the updates available through the Mac App Store, developer download channels, and its security releases pages.